Dynamic analysis tools are often used by computer software developers to test computer software applications, typically by first exploring a computer software application to discover its interfaces, including those by which data may be provided to the application, and then by interacting with the application's interfaces and monitoring the application's responses to such interactions. In one type of dynamic analysis a computer software application is tested for security vulnerabilities by providing test data designed to exploit a security vulnerability as input to the application, and then observing the behavior of the application. For example, dynamic analysis may be used to test a web application by employing a “black-box tester” that sends HTTP requests as input to the web application. The HTTP requests are configured with test payloads drawn from a library of test payloads designed to test for security vulnerabilities such as SQL injection, cross-site scripting (XSS), and command injection.
Such testing is typically performed at different points during the development and modification of a computer software application. For example, during one testing cycle a black-box tester may discover that a certain HTTP parameter is vulnerable to XSS attacks by sending a certain sequence of test payloads. The black-box tester reports the vulnerability to the software developer, who then modifies the underlying instructions of the computer software application to address the vulnerability. During a subsequent testing cycle the black-box tester is likely to test the computer software application using the same test payloads. However, if the modification does not fully address the vulnerability, but suffices to protect against the particular test payloads previously used by the black-box tester, then the black-box tester will not discover that the vulnerability still exists. Furthermore, testing areas of the application that were not modified will necessarily duplicate the results of the previous testing cycle.